feat: add bounded safe backend actions

[yairfalse]

Summary

• add structured ActionResult types with preconditions, risk, before/after evidence, rollback metadata, expiry, and timeline event references
• wire backend drain, undrain, and bounded quarantine through Router, admin REST, remote client, CLI, and MCP
• document safe-action semantics and update MCP tool docs

Validation

• cargo fmt --all -- --check
• cargo test --workspace
• cargo clippy --workspace --all-targets -- -D warnings
• teko verify --claim drain --claim quarantine --claim evidence --claim safety --json
• teko close --json